# One click, cash and revenue gone: cyber insurance for businesses URL: https://insurancelawestonia.ee/blog/2026-11-03-cyber-insurance-ransomware-business/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Published: 2026-11-03 Last updated: 2026-11-06 > Ransomware, business interruption and data breaches: what cyber insurance covers, why property policies are no substitute and what to check in Estonia. A morning phone call: the company's IT system is locked. A message on screen says the files are encrypted and demands a six-figure ransom for recovery. The backups were on the same network and are encrypted too. Production stops, customers cannot be served and every hour adds to the loss. This is not a film script but something that has happened repeatedly to Estonian companies. In 2026 the question is no longer whether a cyberattack will happen but when, and whether the business is ready. ## What cyber insurance is Cyber insurance is a composite non-life product protecting a business against financial loss resulting from disruption of information systems, data or digital operations. Unlike crime insurance, which focuses on deliberate fraud and misappropriation, and D&O insurance, which covers directors' personal liability, cyber cover centres on a technical incident: hacking, ransomware, denial of service or a data breach and its consequences. Modern cyber insurance works as a complete crisis management mechanism. Cover is usually divided into three parts: - **first-party loss:** restoring systems and data, lost income from business interruption, extortion-related costs; - **third-party claims:** claims by customers, partners and data subjects following a breach or service outage; - **incident response costs:** IT forensics, legal advice, crisis communications, notifying regulators and data subjects. Actual protection always depends on the wording. Under Estonian law, § 476(4) of the Law of Obligations Act (võlaõigusseadus, VÕS) is also important: indemnity insurance covers lost profit only if expressly agreed.[^1] Business interruption in a cyber policy is therefore a core element, not an automatic add-on. ## Two international cases that changed the market The 2017 NotPetya malware was not ordinary ransomware but an attack that irreversibly destroyed data. Pharmaceutical company Merck suffered losses of about USD 1.4 billion. Having no standalone cyber cover, Merck claimed under its property policies. Insurers declined, relying on the war exclusion because the attack was attributed to Russian state activity against Ukraine. The New Jersey courts found for Merck: the exclusion was intended for traditional warfare and did not cover a cyberattack on a private company. If insurers wanted to exclude cyber war, they should have changed the wording. The dispute later settled. Food manufacturer Mondelēz, also hit by NotPetya, claimed about USD 100 million from its insurer. That dispute settled out of court in 2022. The market's conclusion from both cases was the same: traditional property and liability policies are not a reliable fallback for cyber risk. Since then insurers have redrafted war and state-sponsored cyberattack exclusions (internationally, the Lloyd's market state-backed cyber attack clauses are widespread), so property insurance can no longer be relied on to cover cyber loss. On broad readings of war exclusions see also [War risk exclusions after Nord Stream](https://insurancelawestonia.ee/blog/2026-11-03-war-risk-exclusions-drones-baltics). ## The Estonian experience Estonian media have repeatedly reported ransomware incidents causing companies multimillion-euro losses. In one case, metalworking companies near Tallinn were attacked after the attackers had mapped the systems in advance and encrypted both on-premises and cloud backups. Production was partly halted for a month and lost income ran to seven figures. In another, a publishing company had lost almost a million euros over five years through repeated attacks. The [Estonian Information System Authority (RIA)](https://www.ria.ee) has confirmed that losses from cybercrime run to millions of euros a year, and that is only the reported total. ## Why cyber insurance is needed **The loss is not limited to the ransom.** The ransom is often a small part of the total loss. Business interruption is usually the largest component, plus restoration, forensics, legal and crisis communications costs. **Traditional insurance is not enough.** War exclusions, the physical damage requirement and uncertainty over whether data is property make property and liability cover unpredictable for cyber risk. **Attackers do not choose victims by size.** SMEs are often more vulnerable because they lack large-company IT capability, yet they may be an entry point into larger partners' systems: the 2013 Target data breach in the US began with access obtained through a small supplier. **The insurer's network is valuable in a crisis.** A key part of cyber insurance is the 24/7 incident hotline, forensic experts, negotiators and lawyers. Decisions taken in the first hours determine the size of the loss. **Regulatory pressure is growing.** Under Article 33 of the [General Data Protection Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) (GDPR), a personal data breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours after the controller became aware of it, unless the breach is unlikely to result in a risk to individuals; where the breach is likely to result in a high risk, data subjects must also be informed without undue delay (Article 34).[^2] Article 83 provides for fines that for serious infringements reach tens of millions of euros or a percentage of global turnover.[^2] A successful attack does not in itself mean the company broke the law: the question is whether its technical and organisational measures were appropriate to the risk. In addition, since 2026 the [Cybersecurity Act](https://www.riigiteataja.ee/akt/K%C3%BCTS) (küberturvalisuse seadus, KüTS), as amended to transpose NIS2, imposes incident reporting duties on entities in scope and makes management board members responsible for security measures (see [Cyber insurance and NIS2 in Estonia](https://insurancelawestonia.ee/blog/2026-11-02-cyber-insurance-nis2-estonia)).[^3] **Liability is multi-layered.** Data subjects may claim pecuniary and non-pecuniary damages under GDPR Article 82; customers and partners may claim economic loss. If cybersecurity was not managed with due care, management board members may face personal liability under § 187 of the Commercial Code (äriseadustik, ÄS). This is where the interplay with [D&O insurance](https://insurancelawestonia.ee/blog/2026-09-29-d-and-o-insurance-estonia-director-liability) matters. On top of all this comes reputational harm, which outlasts the technical incident. ## What to check in the policy The value of insurance lies not in having a policy but in its wording. Check at least the following: 1. **War and state-backed attack exclusion.** Is it drafted narrowly enough to leave ordinary cybercrime covered? Who must prove attribution to a state, and with what evidence? 2. **Business interruption cover.** Waiting period (often 8–12 hours), indemnity period, and whether an outage at a service provider is covered (*dependent business interruption*). 3. **Third-party claims and regulatory proceedings.** Are fines covered where insurable under the applicable law, and are defence costs covered? 4. **Security requirements.** Multi-factor authentication, segregated backups, patching. Under Estonian law the insurer is generally released for breach of a safety requirement only to the extent the breach affected the loss (see [Duty of care and proportionality](https://insurancelawestonia.ee/blog/2026-11-01-duty-of-care-proportionality-supreme-court)), but wording and the cost of a dispute still matter. 5. **Proposal form.** Answers about security controls form part of pre-contractual disclosure. Incorrect answers may give the insurer a right of withdrawal (VÕS § 441) or, in case of fraud, a right of avoidance. 6. **Access to crisis services.** Are the hotline and experts available immediately, and does engaging them require prior consent? ## The common thread: cyber, D&O and crime A cyber incident is often not only a cyber insurance matter. If an attacker uses access to divert a payment to the wrong account, the risk is more likely a crime insurance risk (social engineering, payment fraud). If a claim is later made against a director, D&O cover is engaged. The three policies may overlap or leave gaps. A well-designed programme coordinates them: it is clear which policy is primary, how deductibles interact, and that one policy does not exclude a risk the other also fails to cover. ## Conclusion Cyber insurance is neither a luxury nor a privilege of tech companies; it is as natural a part of responsible business as fire or liability insurance. International and Estonian cases send the same message: an attack does not ask permission or distinguish between large and small businesses. Cyber insurance pays the loss and provides the expert network needed in a crisis. In Estonia this cover is largely written by cross-border insurers and placed through brokers, so wordings are worth comparing and reviewing before binding. *Author: Olavi-Jüri Luik. Law as of November 2026.* ## Related pages - [Cyber claims in Estonia](https://insurancelawestonia.ee/guides/cyber-claims-estonia) - [Crime and fidelity claims in Estonia](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia) - [War exclusions and cyber](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber) - [Breach coach and cyber incident response](https://insurancelawestonia.ee/services-for-insurers/breach-coach-cyber-incidents) ## References [^1]: Law of Obligations Act (võlaõigusseadus, VÕS) § 476(4) (RT I, 20.06.2026, 18; in force 01.09.2026). [^2]: Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 33, 82 and 83, OJ L 119, 4.5.2016, p. 1. [^3]: Cybersecurity Act (küberturvalisuse seadus, KüTS) §§ 6¹, 8 (RT I, 06.10.2026, 2; in force 16.10.2026).